中文摘要
因為加殼技術已成為近幾年惡意程式作者最常使用的技術，造成惡意程式特徵碼混淆，以利躲避防毒軟體偵測，市面上也開發了一些解殼軟體，有研究者針對加殼程式先使用解殼軟體解殼，再判斷是否為惡意程式[1]，但解殼軟體僅能針對部份的加殼程式解殼，亦無法對新型加殼程式或惡意程式作者自行撰寫加殼碼做解殼。而且每一加殼程式均需先經過解殼再來判斷是否為惡意程式太耗費資源及時間。
所以我們希望能針對現今惡意程式的加殼技術來找出防毒的因應之道，且不需經過解殼來判斷是否為惡意程式。利用程式加殼前後的特性，找出足以區分是否加殼的特徵，在做惡意程式特徵訓練時將加殼及未加殼的程式分別分析，才不會造成特徵被混淆，而影響惡意程式偵測結果。
本研究下載最新的VX Heavens資料集內所有Win32種類惡意程式分析，使用有別於一般解殼及防毒軟體的技術，讓系統不僅能有效偵測現有的加殼程式及惡意程式，更能有效預測未知的加殼程式及惡意程式。
本研究先萃取出PE Table裡的特徵，再使用資訊增益方法找出有用的資訊，最後使用SVM針對加殼程式及惡意程式作偵測。

Abstract
Although the shelling technology is very popular among malware authors in the past few years. It causes the confusion of features and it can also avoid detection of anti-virus software. The unshelling software have been developed that can extract encrypted code from shelled program, then revealing invisible malware that can be detected by anti-virus software[1]. But the unshelling software can not unshell the new type, variant shelled program, and it can only unshell a portion of the shelled program. Besides each shelled program is required to through the unshelling process every time then determine whether it is malware or not. It needs a lot of time and resources.
Therefore, we hope to find out a solution for current anti-virus technology by focusing on the shell problem nowadays without unshelling process at first. Because features of the program will change after shelling process, we can use the differences of the features to distinguish if the program is shelled or not. When we train the features of malware, it should be separated from shelled and non-shelled program, then it won’t be confused by shelled features, so the results of malware detection system will be more rigid.
We download the latest VX Heavens dataset of all Wins32 malware in this thesis. It is different from general unshelling and the anti-virus software. Our system can not only detect existing shelled program and malware but also can predict the unknown shelled program and malware efficiently.
In this thesis, we extracted features from PE Table, and then we use the information gain method to find out useful information. We use SVM to detect the shelled program and malware finally.

以文章使用到的順序排序
[1]Roberto Perdisci, Andrea Lanzi, Wenke Lee,
“Classification of packed executables for accurate computer virus detection”, Pattern Recognition Letters 29 (2008) 1941–1946, journal homepage
[2]段鋼,加密與解密(第三版),碁峰資訊股份有限公司,台北,第160-163頁 (2009)
[3]PEid, http://www.peid.info/
[4]VX Heavens, http://vx.netlux.org
[5]蕭崑賢, 基於靜態分析與資料探勘技術之惡意程式偵測系統,台灣科技大學碩士論文,2006
[6]Malware, http://technet.microsoft.com/zh-tw/library/dd180728.aspx
[7]Worm, http://zh.wikipedia.org/zh-tw/%E9%9B%BB%E8%85%A6%E8%A0%95%E8%9F%B2
[8]Backdoor, http://zh.wikipedia.org/zh-tw/%E5%BE%8C%E9%96%80%E8%BB%9F%E4%BB%B6
[9]Spyware, http://zh.wikipedia.org/zh-tw/%E9%97%B4%E8%B0%8D%E8%BD%AF%E4%BB%B6
[10]Joker, http://www.trend.com.tw/vinfo/virusencyclo/glossary.asp#joke_programs
[11]Mix, http://www.trendmicro.com/tw/about/news/pr/archive/2005/pr050711.htm
[12] 陳展維,基於平滑支援向量機之電腦病毒偵測系統,台灣科技大學碩士論文,2004
[13] Lutz Bohne,“Pandora's Bochs:Automatic Unpacking of Malware” University of Mannheim, German(2008)
[14]PE,http://66.163.168.225/babelfish/translate_url_content?.intl=tw&lp=zh_zt&trurl=http%3a%2f%2fwww.pediy.com%2fbbshtml%2fBBS6%2fpediy7006.htm#1
[15]PE,http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/pecoff_v8.docx
[16]PE, http://cpatch.org/siva/cpatch/pe.htm
[17]PE, Matt Pietrek,“An In-Depth Look into the Win32 Portable Executable File Format”,MSDN Magazine, March 2002
[18]葉生正、蘇民揚、張僩鈞、陳相儒,“結合 SVM 與 Naïve Bayes 演算法防堵垃圾郵件的研究”, Journal of Informatics & Electronics, Vol.2, No.1, pp.1-7, October 2007
[19]楊正三,葉明龍,莊麗月,陳禹融,楊正宏,「利用資訊增益與瀰集演算法於基因微陣列之特徵選取與分類問題」,資訊科技國際期刊
[20]Chih-Wei Hsu, Chih-Chung Chang, and Chih-Jen Lin .A Practical Guide to Support Vector Classification.From, http://www.csie.ntu.edu.tw/~cjlin/papers/guide/guide.pdf(2010)
[21]Libsvm, http://www.csie.ntu.edu.tw/~cjlin/libsvm/index.html
[22]Nick Hnatiw, Tom Robinson, Casey Sheehan, Nick Suan,“PIMP MY PE”:PARSING MALICIOUS AND MALFORMED EXECUTABLES, Sunbelt Software
[23]Yang-seo Choi, Ik-kyun Kim, Jin-tae Oh, Jae-cheol Ryou,
Encoded Executable File Detection Technique via Executable File Header Analysis, International Journal of Hybrid Information Technology, Vol.2, No.2, April, 2009
[24]M. Zubair Shafiq, S. Momina Tabish , Fauzan Mirza, Muddassar Farooq, PE-Miner: Mining Structural Information to Detect Malicious Executables in Realtime, nexGIN RC, FAST-NUCES,SEECS,NUST